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Abstract 

A reconhgurable control law for the full X-33 flight 
envelope has been designed to accommodate a failed 
control surface and redistribute the control effort among 
the remaining working surfaces to retain satisfactory 
stability and performance. An offline nonlinear 
constrained optimization approach has been used for the 
X-33 reconhgurable control design method. Using a 
nonlinear, six-degree-of-freedom simulation, three 
example failures are evaluated: ascent with a left body 
hap jammed at maximum dehection; entry with a right 
inboard elevon jammed at maximum dehection; and 
landing with a left rudder jammed at maximum 
dehection. Failure detection and identification are 
accomplished in the actuator controller. Failure response 
comparisons between the nominal control mixer and the 
reconhgurable control subsystem (mixer) show the 
benehts of reconfiguration. Single aerosurface jamming 
failures are considered. The cases evaluated are 
representative of the study conducted to prove the 
adequate and safe performance of the reconhgurable 
control mixer throughout the full flight envelope. The 
X-33 flight control system incorporates reconhgurable 
flight control in the existing baseline system. 

Nomenclature 

BFGS Broyden, Fletcher, Goldfarb and Shanno 

EMA electromechanical actuator 

G Hessian inverse (maps differences in 

position into differences in gradient) 
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H 

Hessian matrix 

k 

iteration 

ONCO 

offline nonlinear constrained optimization 

q 

dynamic pressure, lbf/ft 2 

Qalpha 

longitudinal aerodynamic loading 
parameter, q *a 

Qbeta 

directional aerodynamic loading parameter, 
q *|3 

RCS 

reaction control system 

TAEM 

terminal area energy management 

X 

tunable mixer gains 

X 

vector 

a 

angle of attack, deg 

P 

angle of sideslip, deg 

y 

change in gradients 

5 

difference between two points on quadratic 
function 

V 

first partial derivative or gradient vector 


Introduction 


Aircraft flight control systems are designed with 
extensive redundancy to ensure sufficient failure 
mitigation. Hydraulically powered actuators have been 
used for the past 60 years and currently have a very low 
probability of failure. The X-33 vehicle (hg. 1), 
however, was designed to use one or more two-channel 
electromechanical actuators (EMAs) to power all the 
primary flight control surfaces. 

The X-33 fault tree analysis indicates that EMAs are 
more likely to fail than hydraulic actuators; however, the 
advantages of using EMAs for vehicles like the X-33 
vehicle outweigh the disadvantages. For example, power 
lines are easier to route than hydraulic lines, although 
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Figure 1. X-33 vehicle and aerosurfaces. 


(from Mach 9 decreasing to Mach 3) and concludes that 
an offline nonlinear constrained optimization (ONCO) 
method should be used for the reconfiguration method. 
Preliminary results of the offline method for portions of 
the flight envelope also have been published. 1 

This report investigates the full X-33 flight envelope 
and details the nonlinear simulation results discovered 
in the final design of the reconfigurable flight control 
mixer for the X-33 vehicle. Three specific cases are 
evaluated in this report: a full-deflection body flap 
jamming failure during the ascent phase of flight, a 
full-deflection elevon jamming failure during the entry 
phase, and a full-deflection rudder jamming failure 
during the landing phase. 

Note that use of trade names or names of 
manufacturers in this document does not constitute an 
official endorsement of such products or manufacturers, 
either expressed or implied, by the National Aeronautics 
and Space Administration. 


the weight is approximately the same. Analysis also has 
shown a few unlikely single-failure modes for the 
EMAs, failures that most likely would result in jamming 
of tlie associated aerosurface (the inability to move a 
control surface from a position). 

The baseline X-33 flight control system contains 
control reconfiguration because the vehicle has low 
control effector redundancy compared to other aircraft. 
The primary motivation for pursuing reconfigurable 
control for this vehicle has been to improve use of 
functioning control effectors hi the event of an effector 
failure. Because the EMAs are relatively unproven 
compared to modern hydromechanical actuators, the 
reconfigurable control mixer was designed to allow the 
vehicle to continue to operate in the event of an actuator 
failure. Although arguments could be made that this 
level of redundancy is not needed for an experimental 
aircraft, the X-33 vehicle would have been a technology 
demonstrator test bed to prove concepts for a 
subsequent single-stage-to-orbit, heavy-lift vehicle. 

In designing the reconfigurable control system, 
control surface jamming failures were assumed in each 
of the eight aerosurfaces. Engine thrust vectoring and 
reaction control system (RCS) thrusters, which are part 
of tlie primary flight control system and enabled through 
the nominal control system mixer, are not part of the 
reconfigurable control system mixer and are not 
discussed. 

Reference 1 presents results of four reconfigurable 
trade studies investigated on the X-33 entry flight phase 


X-33 Vehicle Description 

The X-33 vehicle is a subscale, suborbital 
experimental vehicle designed to be a technology 
demonstrator for a single-stage-to-orbit, heavy-lift 
vehicle. The X-33 vehicle has four sets of aerosurfaces: 
rudders, body flaps, and inboard and outboard elevons 
(fig. 1). The X-33 vehicle was designed to use an 
aerospike engine, which allows for pitch and roll thrust 
vectoring as well as differential thrust yaw control. The 
X-33 vehicle also was designed to use RCS thrusters for 
added vehicle control during unpowered flight. 

Nominal Control Description 

Three major phases were to be encountered during tlie 
flight of the X-33 vehicle. The ascent phase would have 
begun at ignition of the main engines and continued 
until “main engine cutoff. - ’ This region of flight would 
have contained augmented control by engine thrust 
vectoring and would have been the only stable region of 
the flight envelope. Command during this phase of flight 
would have been accomplished using an Euler angle 
controller. Longitudinal and directional aerodynamic 
loading parameters were considered in control design to 
ensure structural integrity during this phase of flight. 

After main engine cutoff, the entry phase of flight 
would have begun. This phase of flight would have 
exhibited tlie worst region of instability for the vehicle, 
especially in the low-angle-of-attack regions. The RCS 
would have been used for augmented control in areas of 
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low dynamic pressure in this region of flight. Control 
during this phase would have been accomplished using 
an aerodynamic angle control scheme. 

The terminal area energy management (TAEM) 
phase, also considered the landing phase, would have 
begun when the vehicle had slowed to Mach 3. This 
region of flight also would have exhibited areas of 
instability and been controlled by an acceleration 
command controller. The X-33 vehicle was designed to 
use EMAs to power all the primary flight control 
surfaces. The X-33 vehicle also was designed to be 
controlled through a triplex fly-by-wire flight control 
system operating at 50 samples/sec. 

Figure 2 shows a simulated nominal X-33 trajectory. 
The three flight phases are shown with ascent lasting 
240 sec, entry lasting 260 sec, and TAEM lasting 
265 sec. The vehicle reaches a maximum speed of 
Mach 9 and an altitude of 210,000 ft. Dynamic pressure 
changes from a maximum of 210 lbf/ft 2 at 105 sec to 
approximately 7 lbf/ft 2 at 300 sec. 


because it could be easily tested and validated. The 
X-33 vehicle has “smart actuators” that identify the 
surface that failed and the last known position of the 
failed surface. The failure could be a floating surface, a 
jammed surface, or a surface “hardover.” Knowledge of 
the actuator state simplifies reconfiguration because 
fault detection and isolation is not needed as part of the 
primary flight controller. 

Offline Nonlinear Constrained Optimization 

With prior knowledge of the failure assumed, a table 
lookup of the failure to determine the controller changes 
meets the requirements of reconfiguration and is an 
approach that could be easily implemented. A table 
lookup of the gams has the added advantage of being 
easily tested in the validation and verification process 
required before the first vehicle flight. Therefore, an 
offline method of reconfiguration was decided to have 
tite best chance of success for the X-33 flight program, 
and the ONCO method was chosen. 




Titus, as®* 




Figure 2. X-33 nominal trajectory. 


Figure 3 shows the control block diagram for the 
entry phase of X-33 flight. For this ONCO type of 
reconfiguration, the mixer is modified. Figures 4 and 5 
show the nominal entiy and reconfigurable mixers, 
respectively. The reconfigurable control mixer has more 
interconnect gains than the nominal control mixer. The 
roll command is sent to all the remaining actuators 
through a set of gams; whereas with the nominal mixer, 
the roll command is sent only to the elevons. The 
procedure of increasing interconnects was duplicated 
for the pitch and yaw commands. When a failure occurs, 
file nominal mixer is disabled and the reconfigurable 
mixer is brought online within 280 msec of the failure. 
This procedure of using or changing the mixer to 
accommodate the failure is repeated for the ascent and 
TAEM control phases. 


Reconfigurable Control Design 

The four reconfigurable control design methods 
investigated for the X-33 vehicle were the redistributed 
pseudo-inverse; general constrained optimization; 
automated failure-dependent gain schedule; and the 
offline, or predefined, nonlinear constrained 

'y 

optimization methods. The ONCO approach was 
chosen for implementation. The ONCO method and 
preliminary results of this approach implemented in a 
six-degree-of-freedom simulation are discussed next 
and in reference 1. The ONCO method was chosen 
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Figure 4. Nominal entry control mixer. 


Boll 



Figure 5. Reconfigurable control entry control mixer. 
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The mixer gains were determined beforehand (offline) 
using a sequential quadratic programming method. This 
quasiNewton method is solved for each iteration of the 
quadratic programming problem and updates an 
estimate of the Hessian of the Lagrangian using a 
formula known as the BFGS formula because it was 
suggested by Broyden, Fletcher, Goldfarb and Shanno. 

Equation (1) shows the constrained nonlinear 
optimization: 

Minimum r /'f x ) subject to G(x) <0 ( 1) 

If /(x) is twice differentiable, then a matrix of second 
partial derivatives or Hessian matrix exists; where x is 
the tunable mixer gams, and 


G(x) = V 2 /(x) 

where G is a positive semidefinite matrix and H =G 1 . 
The is approximated by a symmetric 

V J (k) 

positive definite matrix H . The expression shown in 
equation (2) is sometimes called the quasiNewton 
condition. 3, 4 


H (* + D(*) = g(U 


(2) 


An important relationship suggested by Broyden, 
Fletcher, Goldfarb and Shanno is known as the BFGS 
formula: 4 


large enough to stress the algorithm optimization. A 
stressed algorithm occurs when a control surface 
rate-limits or surface position saturates. At this 
condition, the control surface enters into a nonlinear 
region. Simultaneously executing a pitch and roll 
command was necessary to couple the dynamics. 

Optimization based on the BFGS formula was found 
to work satisfactorily for the X-33 reconfigurable 
control law design. The limitations of the sequential 
quadratic programming method are that the function to 
be minimized and the constraints must be continuous, 
and the method might give only local solutions. The 
controls tool package used for the reconfiguration 
development is a well-known control tool set. 5 The 
interested reader is recommended to see the 
proportional, integral, differential demonstration 
included in nonlinear control design blockset for use 
with the Matlab® Simulink® (MathWorks Inc., Natick, 
Massachusetts) package. 5 

Results and Conclusions Using a Nonlinear 
Simulation 

The initial mixer gains were implemented in a six- 
degree-of-freedom simulation. During initial testing of 
the reconfigured mixer gains, some rate limiting and 
position saturation of the actuators were observed. The 
gains were determined to be too large because of 
differences between the linear models and the nonlinear 
simulation. Using empirical methods, the gains were 
reduced, which resulted in very good six-degree-of- 
freedom results. 


H 


(* + l) 

BFGS 
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(3) 


The ONCO method optimizes a time-domain 
response. Using equation (3) to constrain the time- 
domain errors and allowing the gams shown hi figure 5 
to be the tunable parameters (gains in the mixer), a 
series of closed-loop offline simulations are run. After a 
simulation run (usually a step-command response), the 
errors between the commanded and the actual response 
are summed and a new simulation trial is run with the 
modified gain set. The modified gam set is the result of 
using equation (3) to find a constrained optimal 
reduction in the summed error. 

The simulation commands were a combination of roll 
and pitch steps in which the size of the roll command 
was 20° and the size of the pitch command was 2°. The 
sizes of the roll and pitch commands were found to be 


Later in the program, unproved linear models were 
developed that very closely matched the nonlinear six- 
degree-of-freedom simulation, so the gain reductions 
were not needed. Special attention to the linear models 
is extremely important in the design of the controller, 
especially in gain development. Examples are presented 
to show that control reconfiguration addresses three 
different failures in three different flight phases. 

Ascent Phase 

The ascent controller is a Euler command tracking 
system. 6 During the ascent phase, attitude control is 
provided by rocket engine thrust-vector control and the 
aerosutfaces. When a control surface is jammed, all the 
remaining operational control surfaces are used for 
control in conjunction with the thrust-vector control. 

Figure 6(a) shows the response for the nominal and 
reconfigurable control systems of the vehicle with a 
worst-case hardover left body flap jamming at 25° 
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20 sec after lift-off. The time history shows the nominal 
controller with the failed surface held the pitch angle 
error to within 5° hi the longitudinal axis. With the 
reconhgurable controller, pitch angle error was reduced 
to 2°. Figure 6(b) shows the lateral axis response to the 
left body flap failure. Bank angle was controlled to 
within 8° with the nominal controller and to within 3° 
with the reconhgurable control system. 




C-sramai'ssfcd attitude 



(a) Pitch attitude. 
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(b) Roll attitude. 


During the ascent phase of flight, the aerodynamic 
loads on the aircraft must be kept to a minimum so that 
the structural integrity is not jeopardized. Two of the 
design parameters used for structural load minimization 
are the longitudinal and directional aerodynamic 


loading parameters, Qalpha and Qbeta. For the 
directional axis, if the angle of sideslip, (3 , is close to 
0°, then the side loads (Qbeta) will not be a structural 
problem. Figure 6(c) shows times histories of Qalpha 
and Qbeta for the failed ascent case with both nominal 
and reconhgurable control mixers. The results show that 
a reduction in aerodynamic loads will occur if 
reconhgurable controls are used. 


M-srrs&wl ®£8*tallsf 
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(c) Aero load indicator. 
Figure 6. Ascent time responses. 


Figure 6(d) shows plots of the control effectors 
(surface positions) from the nominal and reconhgurable 
mixer simulation flights. When the left body flap was 
jammed at 25° (down), the nominal controller did fully 
compensate for this reaction using thrust vectoring 
available from the engine. The reconhgurable mixer, 
however, did result hi lower Qalpha and Qbeta. 

The body flaps are the most effective aerodynamic 
surfaces on the X-33 vehicle but are the most difficult to 
reconfigure in the event of a failure. Overall ascent 
results show that the nominal controller can handle any 
aerosurface failure; however, the reconhgurable 
controller holds the vehicle closer to the desired flight 
trajectory. 

Entry Phase 

The entry controller is an angle-of-attack command 
tracking system for the longitudinal axis and a bank 
command system for the lateral axis. The entry control 
system has aerosurfaces and eight RCS jets (the thrust 
from each RCS jet is 500 Ibf) for control effectors. 

Approximately 10 sec into the entry phase, the right 
inboard elevon was failed to 25° (fig. 7(a)). A minor 
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Figure 6. Concluded. 


transient appeared for this case because of the low value 
of dynamic pressure that was present at the time of 
failure. The nominal mixer maintained control of the 
vehicle for approximately 70 sec before the vehicle 
departed in the lateral-directional axis (fig. 7(b)). A few 
seconds later, the vehicle also departed longitudinally. 
For the same failure, the reconfigured mixer was able to 
follow the commands for the entire entry flight phase. 
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(b) Lateral-directional. 
Figure 7. Entry time responses. 


Figure 7(c) shows plots of the control effectors 
(surface positions) from the two simulated flights. When 
the right inboard elevon was jammed at 25° (down), the 
left inboard nominal controller did not fully compensate 
for tins reaction; and as a result, the vehicle departed. 
The departure was not immediate because of nominal 
controller compensation with RCS control effectors. 
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Figure 7. Concluded. 


However, figure 6(c) also shows the reconfigurable 
controller compensated for the right inboard elevon 
jamming by commanding the left inboard elevon to 23°. 

The reconfigurable controller uses elevons, flaps, and 
rudders to control the vehicle and achieve the desired 
tracking commands from guidance. As figure 7 shows, 
reconfigurable controls allow the vehicle to continue on 
the desired trajectory to a safe entry conclusion 
(Mach 3). 

Terminal Area Energy Management Phase 

The TAEM phase controller has a normal acceleration 
command system for the longitudinal axis and a bank 
command system for the lateral axis. The TAEM control 
system uses aerosurfaces and RCS jets until the vehicle 
reaches a speed of Mach 2. 

Approximately 20 sec into the TAEM flight phase, the 
left rudder was jammed at —30° (trailing-edge right). A 
rudder failure was chosen for this case because of the 
“heading alignment cone” maneuver that was performed 
during this phase and the corresponding turn 
coordination difficulties encountered with a 270-deg 
mrn. 


Figure 8(a) shows the nominal TAEM controller 
normal acceleration and angle-of-attack time histories 
depart before 40 sec have elapsed. The corresponding 
lateral axis results present a departure in |) at 50 sec for 
the nominal controller (fig. 8(b)). Figure 8(c) shows the 
longitudinal and lateral ground track. The nominal 
controller cannot execute the mrn. The reconfigurable 
controller, however, continues down to a survivable 
landing. 

The reconfigurable controller executed a successful 
landing with a sink rate of 7 ft/sec (fig. 7(c)). Desired 
sink rate landing criterion for this vehicle is 5 ft/sec, 
with an acceptable sink rate not to exceed 10 ft/sec. 
Although landing performance was not desired, it did 
fall within acceptable parameters; and unlike the 
nominal controller, it did allow the aircraft to land safely 
with an aerodynamic surface failure. 

Figure 8(d) shows plots of the control effectors 
(surface positions) from the nominal and reconfigurable 
mixer simulation flights. When the left rudder was 
jammed at —30° (right), the nominal controller did not 
fully compensate for this reaction. The reconfigurable 
controller did allow for a landing of the vehicle within 
acceptable parameters. 
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(c) Landing criteria. 
Figure 8. TAEM time responses. 
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(d) Control surface. 
Figure 8. Concluded. 


Full Flight Envelope Results 

During the ascent phase, the nominal and 
reconfigurable controller worked well. The 
reconfigurable controller had lower aerodynamic loads 
than the nominal controller during ascent. Table 1 shows 
the X-33 failure accommodation. The ascent 
reconfigurable phase was successful for all surface 
failures at speeds from Mach 0 to Mach 9. The entry 
phase, however, had a different outcome. The 


reconfigurable controller could handle all elevon failures 
for all Mach numbers. The body flap was the limiting 
factor in the entry phase of flight. The reconfigurable 
controller could handle only body flap jams between -3° 
and 5° and a limited range from Mach 3 to Mach 5.2. 
The rudders were fully reconfigurable for the entire 
entry envelope. The TAEM phase also was limited in 
scope. The elevons and rudders could fail at any position 
during TAEM and land safely. The body flap, however, 
was limited from -3° to 5°. 


Table 1. X-33 surface failure accommodation. 


Phase 


Surface 


Ascent 


Entiy 


TAEM 


Elevons All Mach numbers (Mach 0-9); 
all surface positions 

Body flap All Mach numbers (Mach 0-9); 
all surface positions 

Rudders All Mach numbers (Mach 0-9); 
all surface positions 


All Mach numbers (Mach 9-3); 
all surface positions 

Limited surface positions; 

Mach 3.0-5 .2 

flap deflection — 3°— 5° 

All Mach numbers (Mach 9-3); 
all surface positions 


All Mach numbers (Mach 3-0); 
all surface positions 

Limited surface positions; 
Mach 0-2.5 
flap deflection — 3°-5° 

All Mach numbers (Mach 3-0); 
all surface positions 
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Concluding Remarks 


References 
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